@subly_fi/pay 0.6.2 → 0.7.1

package/dist/setup-link.js

@@ -26,6 +26,144 @@ function loadSecretKeyBytes(params) {
   throw new Error(`${label} keypair is not configured`);
 }
 
+// ../../src/config/vault-catalog.ts
+import { readFileSync as readFileSync2 } from "node:fs";
+import { z } from "zod";
+
+// ../../src/lib/solana-address.ts
+var BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var BASE58_LOOKUP = new Map(
+  [...BASE58_ALPHABET].map((character, index) => [character, BigInt(index)])
+);
+function assertSolanaAddress(value, fieldName) {
+  if (value.length < 32 || value.length > 44) {
+    throw new Error(`${fieldName} must be a valid Solana public key`);
+  }
+  if (decodeBase58(value).length !== 32) {
+    throw new Error(`${fieldName} must be a valid Solana public key`);
+  }
+  return value;
+}
+function decodeBase58(value) {
+  if (value.length === 0) {
+    return new Uint8Array();
+  }
+  let decoded = 0n;
+  for (const character of value) {
+    const digit = BASE58_LOOKUP.get(character);
+    if (digit === void 0) {
+      return new Uint8Array();
+    }
+    decoded = decoded * 58n + digit;
+  }
+  const bytes = [];
+  while (decoded > 0n) {
+    bytes.push(Number(decoded & 0xffn));
+    decoded >>= 8n;
+  }
+  for (const character of value) {
+    if (character !== "1") {
+      break;
+    }
+    bytes.push(0);
+  }
+  return Uint8Array.from(bytes.reverse());
+}
+
+// ../../src/config/vault.ts
+var MAINNET_USDC_MINT = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
+var KAMINO_VAULT_PROGRAM_ID = "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd";
+var NO_VAULT_FARM = "11111111111111111111111111111111";
+var DEFAULT_VAULT_CONFIG = Object.freeze({
+  address: "5kfkpQZ6AkQgizHVThqkxD4J3db2i7pE3mHdPNRbx7jr",
+  programId: KAMINO_VAULT_PROGRAM_ID,
+  usdcMint: MAINNET_USDC_MINT,
+  shareMint: "7hGX49So539MU9Rrah8nBNVYXswWVwEJvgWNYeBDYq3a",
+  farm: "E2Ct77LowkDAH1T9ubwPpb84pU2GSGrUdgH3KeTTpLX"
+});
+function vaultConfigFromEnv(env = process.env) {
+  const value = (name) => env[name]?.trim() || void 0;
+  const vaultAddress = value("SUBLY_VAULT_ADDRESS") ?? DEFAULT_VAULT_CONFIG.address;
+  const customVault = vaultAddress !== DEFAULT_VAULT_CONFIG.address;
+  const anchor = (name, fallback) => {
+    const configured = value(name);
+    if (customVault && configured === void 0) {
+      throw new Error(
+        `${name} is required for a custom vault. Generate its settings with npm run configure:vault -- <vault-address>; use ${NO_VAULT_FARM} for a vault without a farm.`
+      );
+    }
+    return assertSolanaAddress(configured ?? fallback, name);
+  };
+  const usdcMint = value("SUBLY_VAULT_USDC_MINT") ?? MAINNET_USDC_MINT;
+  if (usdcMint !== MAINNET_USDC_MINT) {
+    throw new Error(
+      "SUBLY_VAULT_USDC_MINT must be mainnet USDC; other deposit assets are not supported"
+    );
+  }
+  return Object.freeze({
+    address: assertSolanaAddress(vaultAddress, "SUBLY_VAULT_ADDRESS"),
+    programId: KAMINO_VAULT_PROGRAM_ID,
+    usdcMint,
+    shareMint: anchor("SUBLY_VAULT_SHARE_MINT", DEFAULT_VAULT_CONFIG.shareMint),
+    farm: anchor("SUBLY_VAULT_FARM", DEFAULT_VAULT_CONFIG.farm)
+  });
+}
+
+// ../../src/config/vault-catalog.ts
+var publicKey = z.string().refine((value) => {
+  try {
+    assertSolanaAddress(value, "vault catalog address");
+    return true;
+  } catch {
+    return false;
+  }
+}, "Invalid Solana public key");
+var catalogSchema = z.object({
+  version: z.literal(1),
+  defaultVault: publicKey,
+  vaults: z.array(z.object({
+    address: publicKey,
+    programId: z.literal(KAMINO_VAULT_PROGRAM_ID),
+    usdcMint: z.literal(MAINNET_USDC_MINT),
+    shareMint: publicKey,
+    farm: publicKey,
+    name: z.string().min(1).max(128).optional(),
+    depositsEnabled: z.boolean().optional(),
+    extraLookupTables: z.array(publicKey).max(16).optional()
+  }).strict()).min(1).max(100)
+}).strict();
+function parseVaultCatalog(value) {
+  const catalog = catalogSchema.parse(value);
+  const addresses = new Set(catalog.vaults.map((vault) => vault.address));
+  if (addresses.size !== catalog.vaults.length) throw new Error("Duplicate vault in catalog");
+  if (!addresses.has(catalog.defaultVault)) throw new Error("defaultVault must be in the vault catalog");
+  return { ...catalog, vaults: catalog.vaults.map((vault) => Object.freeze(vault)) };
+}
+function vaultCatalogFromEnv(env = process.env) {
+  const path = env.SUBLY_VAULTS_FILE?.trim();
+  if (!path) {
+    const vault = vaultConfigFromEnv(env);
+    return { version: 1, defaultVault: vault.address, vaults: [vault] };
+  }
+  const catalog = parseVaultCatalog(JSON.parse(readFileSync2(path, "utf8")));
+  const selected = env.SUBLY_VAULT_ADDRESS?.trim() || catalog.defaultVault;
+  if (!catalog.vaults.some((vault) => vault.address === selected)) {
+    throw new Error("SUBLY_VAULT_ADDRESS must be in SUBLY_VAULTS_FILE");
+  }
+  return { ...catalog, defaultVault: selected };
+}
+function defaultCatalogVault(catalog) {
+  return catalog.vaults.find((vault) => vault.address === catalog.defaultVault);
+}
+
+// ../../src/config/constants.ts
+var PAYMENT_SCHEME = "subly-yield-exact";
+var SOLANA_MAINNET_NETWORK = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
+var SPL_TOKEN_PROGRAM_ID = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
+var ASSOCIATED_TOKEN_PROGRAM_ID = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
+var SUBLY_VAULT = defaultCatalogVault(vaultCatalogFromEnv());
+var USDC_DECIMALS = 6;
+
 // ../../src/client/agent-wallet-signer.ts
 import { signBytes } from "@solana/kit";
 import bs586 from "bs58";
@@ -141,10 +279,10 @@ function ed25519PublicKeyBytes(provider, walletAddress) {
   return bytes;
 }
 function verifiedEd25519Signature(params) {
-  const publicKey = ed25519PublicKeyBytes(params.provider, params.walletAddress);
+  const publicKey2 = ed25519PublicKeyBytes(params.provider, params.walletAddress);
   const encoded = params.encodedSignature.trim();
   for (const candidate of decodeSignatureCandidates(encoded)) {
-    if (nacl.sign.detached.verify(params.message, candidate, publicKey)) {
+    if (nacl.sign.detached.verify(params.message, candidate, publicKey2)) {
       return candidate;
     }
   }
@@ -198,8 +336,8 @@ async function requestVerifiedTransactionSignature(params) {
       `signed transaction is missing the signature for ${transport.walletAddress}`
     );
   }
-  const publicKey = params.publicKey ?? ed25519PublicKeyBytes(transport.provider, transport.walletAddress);
-  if (!nacl.sign.detached.verify(params.messageBytes, signature, publicKey)) {
+  const publicKey2 = params.publicKey ?? ed25519PublicKeyBytes(transport.provider, transport.walletAddress);
+  if (!nacl.sign.detached.verify(params.messageBytes, signature, publicKey2)) {
     throw new RemoteSigningError(
       transport.provider,
       "returned signature does not verify over the requested transaction"
@@ -250,38 +388,6 @@ async function providerJsonRequest(params) {
 import bs585 from "bs58";
 import { getCompiledTransactionMessageDecoder } from "@solana/kit";
 
-// ../../src/config/constants.ts
-var PAYMENT_SCHEME = "subly-yield-exact";
-var SOLANA_MAINNET_NETWORK = "solana:5eykt4UsFv8P8NJdTREpY1vzqKqZKvdp";
-var SPL_TOKEN_PROGRAM_ID = "TokenkegQfeZyiNwAJbNbGKPFXCWuBvf9Ss623VQ5DA";
-var ASSOCIATED_TOKEN_PROGRAM_ID = "ATokenGPvbdGVxr1b2hvZbsiqW5xWH25efTNsLJA8knL";
-var envOr = (name, fallback) => {
-  const value = process.env[name]?.trim();
-  return value ? value : fallback;
-};
-var SUBLY_VAULT = {
-  name: "Subly USDC Payment Vault Alpha",
-  address: envOr(
-    "SUBLY_VAULT_ADDRESS",
-    "5kfkpQZ6AkQgizHVThqkxD4J3db2i7pE3mHdPNRbx7jr"
-  ),
-  programId: "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd",
-  usdcMint: envOr(
-    "SUBLY_VAULT_USDC_MINT",
-    "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v"
-  ),
-  shareMint: envOr(
-    "SUBLY_VAULT_SHARE_MINT",
-    "7hGX49So539MU9Rrah8nBNVYXswWVwEJvgWNYeBDYq3a"
-  ),
-  lookupTable: "7UbXhDnpK7WVnwsfivzQRENoqKqAULQ5s19gS1xJrQEo",
-  farm: envOr(
-    "SUBLY_VAULT_FARM",
-    "E2Ct77LowkDAH1T9ubwPpb84pU2GSGrUdgH3KeTTpLX"
-  )
-};
-var USDC_DECIMALS = 6;
-
 // ../../src/domain/request-binding.ts
 function computeRequestBindingHash(fields) {
   return hashStableJson({
@@ -531,16 +637,16 @@ function validatePaymentIntentTransaction(params) {
   if (intent.network !== SOLANA_MAINNET_NETWORK) {
     reject("network_mismatch", "Unsupported network");
   }
-  if (intent.vault !== SUBLY_VAULT.address) {
+  if (intent.vault !== policy2.vault.address) {
     reject("vault_mismatch", "Unsupported vault");
   }
-  if (intent.shareMint !== SUBLY_VAULT.shareMint) {
+  if (intent.shareMint !== policy2.vault.shareMint) {
     reject("share_mint_mismatch", "Unsupported share mint");
   }
-  if (intent.farm !== SUBLY_VAULT.farm) {
+  if (intent.farm !== policy2.vault.farm) {
     reject("farm_mismatch", "Unsupported Kamino farm");
   }
-  if (intent.asset !== SUBLY_VAULT.usdcMint) {
+  if (intent.asset !== policy2.vault.usdcMint) {
     reject("asset_mismatch", "Only USDC payments are supported");
   }
   if (intent.memo !== intent.paymentId) {
@@ -656,7 +762,7 @@ function validateDepositIntentTransaction(params) {
   if (new Date(intent.expiresAt).getTime() <= now) {
     reject("expired", "Deposit intent has expired");
   }
-  assertVaultIntentTargets(intent);
+  assertVaultIntentTargets(intent, policy2.vault);
   const decoded = decodeIntentTransaction({
     serializedTransaction: params.serializedTransaction,
     ...params.lookupTables === void 0 ? {} : { lookupTables: params.lookupTables }
@@ -679,6 +785,9 @@ function validateDepositIntentTransaction(params) {
       case MEMO_PROGRAM_ID:
         break;
       case KVAULT_PROGRAM_ID: {
+        if (sawDeposit) {
+          reject("duplicate_deposit", "A deposit intent authorizes exactly one KVault deposit");
+        }
         if (!bytesStartWith(ix.data, KVAULT_DEPOSIT_DISCRIMINATOR)) {
           reject("unexpected_instruction", "Unexpected KVault instruction in deposit");
         }
@@ -729,7 +838,7 @@ function validateWithdrawalIntentTransaction(params) {
   if (new Date(intent.expiresAt).getTime() <= now) {
     reject("expired", "Withdrawal intent has expired");
   }
-  assertVaultIntentTargets(intent);
+  assertVaultIntentTargets(intent, policy2.vault);
   const expectedDestination = deriveAssociatedTokenAddress({
     owner: intent.wallet,
     mint: intent.asset
@@ -827,22 +936,23 @@ function validateWithdrawalIntentTransaction(params) {
     );
   }
 }
-function assertVaultIntentTargets(intent) {
-  if (intent.vault !== SUBLY_VAULT.address) {
+function assertVaultIntentTargets(intent, vault) {
+  if (intent.vault !== vault.address) {
     reject("vault_mismatch", "Unsupported vault");
   }
-  if (intent.shareMint !== SUBLY_VAULT.shareMint) {
+  if (intent.shareMint !== vault.shareMint) {
     reject("share_mint_mismatch", "Unsupported share mint");
   }
-  if (intent.farm !== SUBLY_VAULT.farm) {
+  if (intent.farm !== vault.farm) {
     reject("farm_mismatch", "Unsupported Kamino farm");
   }
-  if (intent.asset !== SUBLY_VAULT.usdcMint) {
+  if (intent.asset !== vault.usdcMint) {
     reject("asset_mismatch", "Only USDC is supported");
   }
 }
 function resolveIntentValidationPolicy(policy2) {
   const resolved = {
+    vault: policy2?.vault ?? SUBLY_VAULT,
     maxComputeUnitLimit: policy2?.maxComputeUnitLimit ?? DEFAULT_MAX_COMPUTE_UNIT_LIMIT,
     maxComputeUnitPriceMicroLamports: policy2?.maxComputeUnitPriceMicroLamports ?? DEFAULT_MAX_COMPUTE_UNIT_PRICE_MICRO_LAMPORTS,
     maxTemporaryAccountLamports: policy2?.maxTemporaryAccountLamports ?? MAX_TEMP_ACCOUNT_LAMPORTS
@@ -1194,10 +1304,12 @@ function readShortVec(bytes, startOffset) {
 
 // ../../src/client/agent-wallet-signer.ts
 var IntentValidatingAgentWalletSigner = class {
+  vault;
   validationMode = "structured_intent_transaction";
   validationPolicy;
   constructor(validationPolicy) {
-    this.validationPolicy = validationPolicy;
+    this.vault = Object.freeze({ ...validationPolicy?.vault ?? SUBLY_VAULT });
+    this.validationPolicy = { ...validationPolicy, vault: this.vault };
   }
   async signPayment(params) {
     this.assertIntentWallet(params.intent.wallet);
@@ -1355,15 +1467,15 @@ async function createCircleSignerTransport(config) {
   const entitySecretCiphertext = async () => {
     if (entityPublicKey === null) {
       const data = await request("GET", "/v1/w3s/config/entity/publicKey");
-      const publicKey = data.publicKey;
-      if (typeof publicKey !== "string") {
+      const publicKey2 = data.publicKey;
+      if (typeof publicKey2 !== "string") {
         throw new RemoteSigningError(
           PROVIDER,
           "entity public key response has no publicKey",
           data
         );
       }
-      entityPublicKey = createPublicKey(publicKey);
+      entityPublicKey = createPublicKey(publicKey2);
     }
     return publicEncrypt(
       {
@@ -1635,6 +1747,45 @@ async function agentWalletSignerFromEnv(env = process.env) {
   );
 }
 
+// ../../src/client/withdrawal-preview.ts
+var ROUNDING_RAW_USDC = 10n;
+async function assertWithdrawalPreview(input) {
+  const destination = deriveAssociatedTokenAddress({ owner: input.wallet, mint: input.vault.usdcMint });
+  const simulation = await input.rpc.simulateTransaction(
+    input.serializedTransaction,
+    {
+      encoding: "base64",
+      commitment: "confirmed",
+      sigVerify: false,
+      replaceRecentBlockhash: false,
+      innerInstructions: true
+    }
+  ).send({ abortSignal: AbortSignal.timeout(15e3) });
+  if (simulation.value.err !== null) {
+    throw new Error("Withdrawal preview failed on the client RPC; no transaction was signed. Check liquidity, RPC and blockhash, then prepare again.");
+  }
+  let received = 0n;
+  for (const group of simulation.value.innerInstructions ?? []) {
+    for (const instruction of group.instructions) {
+      if (!("parsed" in instruction) || instruction.programId !== SPL_TOKEN_PROGRAM_ID) continue;
+      const parsed = instruction.parsed;
+      if (parsed.type !== "transfer" && parsed.type !== "transferChecked") continue;
+      const info = parsed.info;
+      if (!info || info.destination !== destination && info.source !== destination) continue;
+      const raw = parsed.type === "transferChecked" ? info.tokenAmount?.amount : info.amount;
+      if (typeof raw !== "string" || !/^\d+$/.test(raw)) {
+        throw new Error("Withdrawal preview returned an invalid token amount");
+      }
+      const amount = BigInt(raw);
+      if (info.destination === destination) received += amount;
+      if (info.source === destination) received -= amount;
+    }
+  }
+  if (received <= 0n || received > input.amountRawUsdc + ROUNDING_RAW_USDC || received < input.amountRawUsdc - ROUNDING_RAW_USDC) {
+    throw new Error("Withdrawal preview differs from the requested USDC amount; no transaction was signed");
+  }
+}
+
 // ../../src/client/lookup-tables.ts
 import { fetchAllMaybeAddressLookupTable } from "@solana-program/address-lookup-table";
 import { address, getCompiledTransactionMessageDecoder as getCompiledTransactionMessageDecoder2 } from "@solana/kit";
@@ -1728,6 +1879,8 @@ var VaultFlowClientError = class extends Error {
   errorDetails;
 };
 var VaultFlowClient = class {
+  vault;
+  rpc;
   baseUrl;
   signer;
   fetchImpl;
@@ -1735,6 +1888,11 @@ var VaultFlowClient = class {
   pollTimeoutMs;
   pollIntervalMs;
   constructor(config) {
+    this.rpc = config.rpc;
+    this.vault = config.vault ?? config.signer.vault ?? SUBLY_VAULT;
+    if (config.signer.vault && config.signer.vault.address !== this.vault.address) {
+      throw new Error("Vault flow client and signer must select the same vault");
+    }
     this.baseUrl = config.relayerBaseUrl.replace(/\/$/, "");
     this.signer = config.signer;
     this.fetchImpl = config.fetchImpl ?? fetch;
@@ -1756,6 +1914,7 @@ var VaultFlowClient = class {
     try {
       prepared = await this.postJson("prepare", "/v1/deposits/prepare", {
         wallet: this.signer.walletAddress,
+        vault: this.vault.address,
         amountRawUsdc: input.amountRawUsdc.toString(),
         ...approvalId === void 0 ? {} : { approvalId }
       });
@@ -1769,10 +1928,14 @@ var VaultFlowClient = class {
       }
       prepared = await this.postJson("prepare", "/v1/deposits/prepare", {
         wallet: this.signer.walletAddress,
+        vault: this.vault.address,
         amountRawUsdc: input.amountRawUsdc.toString(),
         approvalId
       });
     }
+    if (prepared.signingIntent?.wallet !== this.signer.walletAddress || prepared.signingIntent.vault !== this.vault.address || prepared.signingIntent.amountRawUsdc !== input.amountRawUsdc.toString()) {
+      throw new VaultFlowClientError("prepare", "Prepared deposit differs from the requested wallet, vault or amount");
+    }
     const signed = await this.signer.signDeposit({
       intent: prepared.signingIntent,
       serializedTransaction: prepared.serializedTransaction,
@@ -1810,12 +1973,23 @@ var VaultFlowClient = class {
       "/v1/withdrawals/prepare",
       {
         wallet: this.signer.walletAddress,
+        vault: this.vault.address,
         amountRawUsdc: input.amountRawUsdc.toString(),
         ...input.purpose === void 0 ? {} : { purpose: input.purpose },
         ...input.payment === void 0 ? {} : { payment: input.payment },
         ...input.approvalId === void 0 ? {} : { approvalId: input.approvalId }
       }
     );
+    if (prepared.signingIntent?.wallet !== this.signer.walletAddress || prepared.signingIntent.vault !== this.vault.address || prepared.requestedWithdrawRawUsdc !== input.amountRawUsdc.toString() || prepared.purpose !== (input.purpose ?? "normal") || input.purpose === "yield_realize" && prepared.signingIntent.allowFullExit) {
+      throw new VaultFlowClientError("prepare", "Prepared withdrawal differs from the requested operation");
+    }
+    await assertWithdrawalPreview({
+      rpc: this.rpc,
+      serializedTransaction: prepared.serializedTransaction,
+      wallet: this.signer.walletAddress,
+      vault: this.vault,
+      amountRawUsdc: input.amountRawUsdc
+    });
     const signed = await this.signer.signWithdrawal({
       intent: prepared.signingIntent,
       serializedTransaction: prepared.serializedTransaction,
@@ -1853,12 +2027,12 @@ var VaultFlowClient = class {
         await this.postJson(
           "sync",
           `/v1/wallets/${this.signer.walletAddress}/sync`,
-          { source: "chain" }
+          { source: "chain", vault: this.vault.address }
         );
       } catch {
       }
     }
-    const url = `${this.baseUrl}/v1/wallets/${this.signer.walletAddress}/budget`;
+    const url = `${this.baseUrl}/v1/wallets/${this.signer.walletAddress}/budget?vault=${this.vault.address}`;
     const response = await this.fetchImpl(url, {
       headers: await walletAuthHeaders({
         signer: this.signer,
@@ -1884,8 +2058,12 @@ var VaultFlowClient = class {
       );
     }
     const body = parsed;
+    if (body.position?.vault !== void 0 && body.position.vault !== this.vault.address) {
+      throw new VaultFlowClientError("budget", "Relayer returned the budget for a different vault");
+    }
     return {
       wallet: this.signer.walletAddress,
+      vault: this.vault.address,
       principalBasisRawUsdc: body.position?.principalBasisRawUsdc ?? "0",
       positionValueRawUsdc: body.budget?.positionValueRawUsdc ?? "0",
       grossYieldRawUsdc: body.budget?.grossYieldRawUsdc ?? "0",
@@ -1903,7 +2081,7 @@ var VaultFlowClient = class {
   /** Wallet's approvals as the relayer sees them (optionally by status). */
   async listApprovals(status) {
     const body = await this.getJson(
-      `/v1/wallets/${this.signer.walletAddress}/approvals${status === void 0 ? "" : `?status=${encodeURIComponent(status)}`}`
+      `/v1/wallets/${this.signer.walletAddress}/approvals${`?vault=${this.vault.address}${status === void 0 ? "" : `&status=${encodeURIComponent(status)}`}`}`
     );
     return body.approvals ?? [];
   }
@@ -1912,16 +2090,21 @@ var VaultFlowClient = class {
    * policy + initial deposit). Paste `setupUrl` into the chat verbatim.
    */
   async createSetupSession(input) {
-    return await this.postJson(
+    const session = await this.postJson(
       "prepare",
       `/v1/wallets/${this.signer.walletAddress}/setup-sessions`,
       {
+        vault: this.vault.address,
         ...input.policy === void 0 ? {} : { policy: input.policy },
         ...input.enforcementMode === void 0 ? {} : { enforcementMode: input.enforcementMode },
         ...input.mandateTtlDays === void 0 ? {} : { mandateTtlDays: input.mandateTtlDays },
         ...input.initialDepositRawUsdc === void 0 ? {} : { initialDepositRawUsdc: input.initialDepositRawUsdc }
       }
     );
+    if (session.vault !== this.vault.address || session.wallet !== this.signer.walletAddress) {
+      throw new VaultFlowClientError("prepare", "Relayer returned a setup session for a different wallet or vault");
+    }
+    return session;
   }
   /** Polls a setup session (public capability URL — no auth needed). */
   async getSetupSession(sessionId) {

package/dist/vaults.js

@@ -0,0 +1,129 @@
+// ../../src/config/vault-catalog.ts
+import { readFileSync } from "node:fs";
+import { z } from "zod";
+
+// ../../src/lib/solana-address.ts
+var BASE58_ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var BASE58_LOOKUP = new Map(
+  [...BASE58_ALPHABET].map((character, index) => [character, BigInt(index)])
+);
+function assertSolanaAddress(value, fieldName) {
+  if (value.length < 32 || value.length > 44) {
+    throw new Error(`${fieldName} must be a valid Solana public key`);
+  }
+  if (decodeBase58(value).length !== 32) {
+    throw new Error(`${fieldName} must be a valid Solana public key`);
+  }
+  return value;
+}
+function decodeBase58(value) {
+  if (value.length === 0) {
+    return new Uint8Array();
+  }
+  let decoded = 0n;
+  for (const character of value) {
+    const digit = BASE58_LOOKUP.get(character);
+    if (digit === void 0) {
+      return new Uint8Array();
+    }
+    decoded = decoded * 58n + digit;
+  }
+  const bytes = [];
+  while (decoded > 0n) {
+    bytes.push(Number(decoded & 0xffn));
+    decoded >>= 8n;
+  }
+  for (const character of value) {
+    if (character !== "1") {
+      break;
+    }
+    bytes.push(0);
+  }
+  return Uint8Array.from(bytes.reverse());
+}
+
+// ../../src/config/vault.ts
+var MAINNET_USDC_MINT = "EPjFWdd5AufqSSqeM2qN1xzybapC8G4wEGGkZwyTDt1v";
+var KAMINO_VAULT_PROGRAM_ID = "KvauGMspG5k6rtzrqqn7WNn3oZdyKqLKwK2XWQ8FLjd";
+var NO_VAULT_FARM = "11111111111111111111111111111111";
+var DEFAULT_VAULT_CONFIG = Object.freeze({
+  address: "5kfkpQZ6AkQgizHVThqkxD4J3db2i7pE3mHdPNRbx7jr",
+  programId: KAMINO_VAULT_PROGRAM_ID,
+  usdcMint: MAINNET_USDC_MINT,
+  shareMint: "7hGX49So539MU9Rrah8nBNVYXswWVwEJvgWNYeBDYq3a",
+  farm: "E2Ct77LowkDAH1T9ubwPpb84pU2GSGrUdgH3KeTTpLX"
+});
+function vaultConfigFromEnv(env = process.env) {
+  const value = (name) => env[name]?.trim() || void 0;
+  const vaultAddress = value("SUBLY_VAULT_ADDRESS") ?? DEFAULT_VAULT_CONFIG.address;
+  const customVault = vaultAddress !== DEFAULT_VAULT_CONFIG.address;
+  const anchor = (name, fallback) => {
+    const configured = value(name);
+    if (customVault && configured === void 0) {
+      throw new Error(
+        `${name} is required for a custom vault. Generate its settings with npm run configure:vault -- <vault-address>; use ${NO_VAULT_FARM} for a vault without a farm.`
+      );
+    }
+    return assertSolanaAddress(configured ?? fallback, name);
+  };
+  const usdcMint = value("SUBLY_VAULT_USDC_MINT") ?? MAINNET_USDC_MINT;
+  if (usdcMint !== MAINNET_USDC_MINT) {
+    throw new Error(
+      "SUBLY_VAULT_USDC_MINT must be mainnet USDC; other deposit assets are not supported"
+    );
+  }
+  return Object.freeze({
+    address: assertSolanaAddress(vaultAddress, "SUBLY_VAULT_ADDRESS"),
+    programId: KAMINO_VAULT_PROGRAM_ID,
+    usdcMint,
+    shareMint: anchor("SUBLY_VAULT_SHARE_MINT", DEFAULT_VAULT_CONFIG.shareMint),
+    farm: anchor("SUBLY_VAULT_FARM", DEFAULT_VAULT_CONFIG.farm)
+  });
+}
+
+// ../../src/config/vault-catalog.ts
+var publicKey = z.string().refine((value) => {
+  try {
+    assertSolanaAddress(value, "vault catalog address");
+    return true;
+  } catch {
+    return false;
+  }
+}, "Invalid Solana public key");
+var catalogSchema = z.object({
+  version: z.literal(1),
+  defaultVault: publicKey,
+  vaults: z.array(z.object({
+    address: publicKey,
+    programId: z.literal(KAMINO_VAULT_PROGRAM_ID),
+    usdcMint: z.literal(MAINNET_USDC_MINT),
+    shareMint: publicKey,
+    farm: publicKey,
+    name: z.string().min(1).max(128).optional(),
+    depositsEnabled: z.boolean().optional(),
+    extraLookupTables: z.array(publicKey).max(16).optional()
+  }).strict()).min(1).max(100)
+}).strict();
+function parseVaultCatalog(value) {
+  const catalog = catalogSchema.parse(value);
+  const addresses = new Set(catalog.vaults.map((vault) => vault.address));
+  if (addresses.size !== catalog.vaults.length) throw new Error("Duplicate vault in catalog");
+  if (!addresses.has(catalog.defaultVault)) throw new Error("defaultVault must be in the vault catalog");
+  return { ...catalog, vaults: catalog.vaults.map((vault) => Object.freeze(vault)) };
+}
+function vaultCatalogFromEnv(env = process.env) {
+  const path = env.SUBLY_VAULTS_FILE?.trim();
+  if (!path) {
+    const vault = vaultConfigFromEnv(env);
+    return { version: 1, defaultVault: vault.address, vaults: [vault] };
+  }
+  const catalog = parseVaultCatalog(JSON.parse(readFileSync(path, "utf8")));
+  const selected = env.SUBLY_VAULT_ADDRESS?.trim() || catalog.defaultVault;
+  if (!catalog.vaults.some((vault) => vault.address === selected)) {
+    throw new Error("SUBLY_VAULT_ADDRESS must be in SUBLY_VAULTS_FILE");
+  }
+  return { ...catalog, defaultVault: selected };
+}
+
+// src/vaults.ts
+console.log(JSON.stringify(vaultCatalogFromEnv(), null, 2));